aboutsummaryrefslogtreecommitdiffstats
path: root/reassemble.c
AgeCommit message (Collapse)AuthorFilesLines
2005-02-09Move the following files from /trunk to /trunk/epan:Lars Roland1-1833/+0
asn1.[ch] follow.[ch] ptvcursor.[ch] reassemble.[ch] xmlstub.[ch] fix #include statements accordingly. svn path=/trunk/; revision=13366
2004-07-18Move dissectors to epan/dissectors directory.Gilbert Ramirez1-1/+1
Also move ncp222.py, x11-fields, process-x11-fields.pl, make-reg-dotc, and make-reg-dotc.py. Adjust #include lines in files that include packet-*.h files. svn path=/trunk/; revision=11410
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-06-25fix bug in reassembly from last checkinRonnie Sahlberg1-2/+2
From Richard van der Hoff svn path=/trunk/; revision=11232
2004-06-24from todd sRonnie Sahlberg1-1/+142
update to reassembly of dg style dcerpc svn path=/trunk/; revision=11227
2004-06-20In "show_fragment()", use common code to put the top-level entry intoGuy Harris1-30/+26
the protocol tree for the fragment, regardless of whether the fragment has any flags set or not, and, in that common code, handle fragments with 0 bytes of data specially (at least in NDS, you can get zero-length fragments - including the last fragment, so you can't just ignore those fragments; the last fragment has to be added to finish off the reassembly). svn path=/trunk/; revision=11198
2004-05-15remove FI_LINK again,Ulf Lamping1-3/+1
as this info can be derived from the presence of the FT_FRAMENUM field svn path=/trunk/; revision=10900
2004-05-14add support to link from specially marked fields to related packets,Ulf Lamping1-6/+18
a doubleclick will follow the link svn path=/trunk/; revision=10897
2004-04-24add fragment length output to the payload outputUlf Lamping1-5/+7
svn path=/trunk/; revision=10680
2003-12-22We need to do the "if the first fragment we see has no more fragmentsGuy Harris1-8/+14
after it, treat it as the only fragment" stuff for "fragment_add_seq_next()" as well, so we handle non-fragmented packets. svn path=/trunk/; revision=9405
2003-12-20Do the special "if the first fragment we see is also the final fragment,Guy Harris1-20/+40
treat it as a reassembled frame" hack *only* for 802.11, as that's the only protocol we know of that requires it. svn path=/trunk/; revision=9367
2003-09-25When showing a fragment subtree, put spaces after colons to make thingsTim Potter1-3/+3
look a bit nicer. Also separate frame and payload data by a comma. svn path=/trunk/; revision=8538
2003-08-28Update a comment.Guy Harris1-2/+5
svn path=/trunk/; revision=8296
2003-08-28Make "process_reassembled_data()" do the check for fragmentation notGuy Harris1-32/+48
being complete and for fragmentation being trivial (i.e., the packet in question is both the first and last fragment). Have its callers *not* do that check - this lets "process_reassembled_data()" put in the "Reassembled in" item for fragments other than the last fragment. Add a "Reassembled in" field to TDS. svn path=/trunk/; revision=8295
2003-07-31From Tomas Kukosa: set FD_DEGRAGMENTED even if there's only oneGuy Harris1-1/+2
fragment. svn path=/trunk/; revision=8117
2003-06-04There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris1-37/+56
multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
2003-04-30Fix up the overlap checks in the fragment_add_seq functions forGuy Harris1-17/+65
fully-reassembled packets. svn path=/trunk/; revision=7615
2003-04-20Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris1-29/+60
null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
2003-04-20Put entries for a reassembled packet into the appropriate hash table forGuy Harris1-41/+20
all of the frames that make it up, so Ethereal can show, for all but the final frame, the frame in which it was reassembled. (Tethereal can't, as it's a one-pass program.) svn path=/trunk/; revision=7511
2003-04-20Pull much of the processing done after a call to "fragment_add_check()"Guy Harris1-1/+86
into a subroutine, for use in other dissectors. Use it in the IPv6 and CLNP dissectors. svn path=/trunk/; revision=7510
2003-04-20Add a "fragment_add_multiple_ok()" routine that skips the check for aGuy Harris1-6/+31
fragment having been added already. In protocols using the ONC RPC-over-TCP record-marking mechanism (RPC-over-TCP and NDMP), there can be more than one record-marking-layer fragment in a single TCP segment, and thus can be more than one fragment in a frame being added to a given higher-level packet. svn path=/trunk/; revision=7508
2003-04-20We can't use the frame_data structure as a key structure when lookingGuy Harris1-131/+248
for reassembled frames - in Tethereal, there's only one frame_data structure used for all frames. Instead, use the frame number itself as the key. Add a "fragment_add_check()" routine, for fragments where there's a fragment offset rather than a fragment sequence number, which does the same sort of thing as "fragment_add_seq_check()" - i.e., once reassembly is done, it puts the reassembled fragment into a separate hash table, so that there're only incomplete reassemblies in the fragment hash table. That's necessary in order to handle cases where the packet ID field can be reused. Use that routine for IPv4 fragment reassembly - IP IDs can be reused (in fact, RFC 791 suggests that doing so might be a feature: It is appropriate for some higher level protocols to choose the identifier. For example, TCP protocol modules may retransmit an identical TCP segment, and the probability for correct reception would be enhanced if the retransmission carried the same identifier as the original transmission since fragments of either datagram could be used to construct a correct TCP segment. and RFC 1122 says that it's permitted to do so, although it also says "we believe that retransmitting the same Identification field is not useful": 3.2.1.5 Identification: RFC-791 Section 3.2 When sending an identical copy of an earlier datagram, a host MAY optionally retain the same Identification field in the copy. DISCUSSION: Some Internet protocol experts have maintained that when a host sends an identical copy of an earlier datagram, the new copy should contain the same Identification value as the original. There are two suggested advantages: (1) if the datagrams are fragmented and some of the fragments are lost, the receiver may be able to reconstruct a complete datagram from fragments of the original and the copies; (2) a congested gateway might use the IP Identification field (and Fragment Offset) to discard duplicate datagrams from the queue. However, the observed patterns of datagram loss in the Internet do not favor the probability of retransmitted fragments filling reassembly gaps, while other mechanisms (e.g., TCP repacketizing upon retransmission) tend to prevent retransmission of an identical datagram [IP:9]. Therefore, we believe that retransmitting the same Identification field is not useful. Also, a connectionless transport protocol like UDP would require the cooperation of the application programs to retain the same Identification value in identical datagrams. and, in any case, I've seen that in at least one capture, and it confuses the current reassembly code). Unfortunately, that means that fragments other than the last fragment can't be tagged with the frame number in which the reassembly was done; see the comment in packet-ip.c for a discussion of that problem. svn path=/trunk/; revision=7506
2003-04-19The first element in a fragment list isn't a fragment, it's a specialGuy Harris1-14/+26
entry for the reassembled packet; don't look at it when checking to see if we've already seen a fragment (its "frame" field isn't initialized, so we shouldn't check it in any case). svn path=/trunk/; revision=7498
2003-04-17Add a small extra check in fragment_add() to make it idempotent.Ronnie Sahlberg1-2/+16
This solves a problem introduced by the recent rewrite of dcerpc-over-smb reassembly which caused the last fragment for each dcerpc pdu to be duplicated and flagged as overlapping fragment. This svn path=/trunk/; revision=7478
2003-04-09Added new field reassembled_in to the fragment data structure.Ronnie Sahlberg1-2/+7
This field gets set to the frame number when this pdu was first completely reassembled. This is useful since it will allow us to do reassembly properly in say packet-ip.c instead of printing the full pdu for every fragment and thus making NFSoverUDP rpc-rtt statistics less than useful. A dissector using fragment_add() can tehn choose to only dissect the reassembled PDU only for the frame where it was first reassembled. svn path=/trunk/; revision=7427
2003-03-04When deciding whether we have enough data in a lower-level packet toGuy Harris1-4/+4
attempt reassembly of a higher-level packet that includes the lower-level packet, use "tvb_bytes_exist()" to check whether all the data that's to be included in the reassembly is available, rather than by checking whether the packet is short. Add some checks of that sort that were missing. Use the reported length of the packet when doing reassembly. Make the "iphdrlen" field of a "packet_info" structure be the length of the IP header in bytes, not in 4-byte words. svn path=/trunk/; revision=7274
2002-12-19Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg1-3/+5
list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
2002-12-02Don't cast away constness, and fix variable and structure memberGuy Harris1-7/+7
qualifiers as necessary to ensure that we don't have to. "strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't test their results as if they did. Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes. Update Michael Tuexen's e-mail address. svn path=/trunk/; revision=6726
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-15/+64
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-10-17Flag fragment overlaps when reassembling based on sequence number, and,Guy Harris1-12/+20
when displaying the fragment tree for reassembly based on sequence number, show the correct offset. svn path=/trunk/; revision=6448
2002-10-17Put in a missing check for fragment overlaps, and add an assertion toGuy Harris1-2/+7
check for bogus dfpos values before using the value. svn path=/trunk/; revision=6447
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-40/+40
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-06-17Don't check for a short frame until we care whether the frame is short;Guy Harris1-5/+2
that lets us get rid of a variable. svn path=/trunk/; revision=5689
2002-06-07Put the stuff to add the "Illegal {fragment,segment}" item to the InfoGuy Harris1-21/+19
column, and to return TRUE or FALSE, depending on whether there were any reassembly errors, in a common routine. svn path=/trunk/; revision=5645
2002-06-07Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris1-63/+116
but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
2002-06-05Added show_fragment_tree() to reassemble. This function will do the commonRonnie Sahlberg1-1/+90
task of creating a fregment tree for the fragmented packets. Having this identical code to create this tree in every dissector that does PDU reassembly is a huge waste and duplication of code. Updated IP, SMB and DCERPC to use the new function. svn path=/trunk/; revision=5626
2002-05-24Reassembly of fragmented DCE/RPC (only for connection oriented DCE/RPC).Ronnie Sahlberg1-1/+21
svn path=/trunk/; revision=5548
2002-04-25"fragment_add_seq_work()" returns a Boolean value, not a pointer, soGuy Harris1-2/+2
have it return FALSE, not NULL. svn path=/trunk/; revision=5249
2002-04-22Get rid of some unused variables and arguments.Guy Harris1-12/+4
svn path=/trunk/; revision=5221
2002-04-17In "fragment_add_seq_check()", handle short frames the same wayGuy Harris1-49/+24
regardless of whether they're the first frame we see in a reassembly or not - put all but the last fragment into the hash table (so subsequent frames with the same reassembly ID don't get misdissected as unfragmented frames), return the head of the fragment list for the first fragment and NULL for all other fragments (so the first fragment gets dissected as a fragmented packet), and unhash the fragment head from the reassembly hash table when we see the last fragment. svn path=/trunk/; revision=5189
2002-04-17Don't try to reassemble short frames - but do still pass them through atGuy Harris1-17/+86
least some of the reassembly mechanism, so we can deal with both bogus and real last fragment (display the bogus ones as unfragmented frames, treat the real ones as fragments). svn path=/trunk/; revision=5186
2002-04-17Don't bother with "reassembled_key" structures - just use theGuy Harris1-52/+33
"frame_data" structure for the frame as the key structure, and use the frame number in that field as the key. (We could be even cheesier and use the frame number as the key, with casts.) When we move an entry from the hash table of reassemblies to the hash table of reassembled packets, free the key structure for the first hash table. (This doesn't plug a leak, as they get freed when you reinitialize the data structures, but it does reduce the memory needed for them to the amount needed for in-progress reassemblies rather than the amount needed for all reassemblies.) svn path=/trunk/; revision=5180
2002-04-17Add a separate hash table to the reassembly code for reassembledGuy Harris1-67/+343
packets, using the reassembly ID and the frame number of the final frame as the key. There is no guarantee that reassembly IDs won't be reused, even when talking between the same source and destination address; if, once reassembly is complete, the "fragment_data" structure is moved to the latter hash table, this will keep reused reassembly IDs from causing mis-reassembly. Add a routine "fragment_add_seq_check()", which if a fragment has the "more fragments" flag not set but is the first fragment of a reassembly, treats that as a non-fragmented frame, allocating a "fragment_data" structure for the reassembly but not attaching any fragment to it, and adding it to a reassembled packet list; if a packet has been reassembled, removes it from the table of reassemblies and moves it to the table of reassembled packets; if the frame's been seen already, looks it up in the table of reassembled packets rather than the table of reassemblies. Add reassembly support for fragmented 802.11 frames. Use "fragment_add_seq_check()" to cope with the fact that some hardware+drivers apparently hands us reassembled frames with a non-zero fragment number and the "more fragments" bit clear (as if it puts the 802.11 header of the *last* fragment onto the reassembled data). svn path=/trunk/; revision=5177
2002-04-17Rename the "frag_offset" argument of "fragment_add_seq()" toGuy Harris1-5/+5
"frag_number", to make it clearer that it's not a byte offset but a sequence number. svn path=/trunk/; revision=5175
2002-03-31From Joerg Mayer: mark function arguments as unused.Guy Harris1-2/+2
svn path=/trunk/; revision=5052
2002-02-03From Ricardo Barroetave�a: support dissectors that are handedGuy Harris1-10/+76
reassembled TCP data being able to indicate that they need still more reassembly, so that, for example, a dissector can indicate that it needs reassembly in order to dissect a header that says how long the PDU is and, when that reassembly is done and it dissects the header, it can then indicate that it needs more reassembly to get the entire PDU. svn path=/trunk/; revision=4694
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-2/+2
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-04WTP reassembly, from Tom Uijldert.Guy Harris1-4/+4
svn path=/trunk/; revision=4480
2001-12-15From Ronnie Sahlberg: new infrastructure to reassemble packets whereGuy Harris1-2/+241
fragments are identified by block sequence numbers and not byte offsets. svn path=/trunk/; revision=4398
2001-11-24Assorted changes from Ronnie Sahlberg:Guy Harris1-1/+99
Add a few small functions to reassemble.c to cope with protocols where the total length of defragmented PDUs are specified in the first fragment (all previous uses of reassembly has been for PDUs where the last fragment is signalled by a flag in the header for the last fragment). Add a few small functions to reassemble.c to abort-and-delete defragmentation of PDUs and also detect IF a PDU is currently being defragmented. (Useful for PDUs where the "unique" identifier is rather ununique, or may be reused often enough so it can be a problem for Ethereal.) Change where NT Cancel presents its Cancelation-to output, and makes the three trans secondary requests also output similar information. svn path=/trunk/; revision=4255
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-26 20:28:58 +0000